Files

T

Erki AasandClaude Opus 4.8 18034b7cd9 Rotate gitea INTERNAL_TOKEN and JWT_SECRET into separate claims

Post-breach (CVE-2026-59774) rotation. All three security secrets shared
one generated value via the gitea-random SecretClaim, and the file-read
exploit leaked it. Split INTERNAL_TOKEN and JWT_SECRET into their own
claims (gitea-internal-token, gitea-oauth2-jwt) with fresh distinct
values and repoint the StatefulSet at them.

INTERNAL_TOKEN is the secret the attacker actually used against the
still-internet-reachable /api/internal, so this closes reuse of any saved
copy. Rotating JWT_SECRET invalidates gitea-issued OAuth2 and LFS tokens,
so the OAuth2 integrations (Woodpecker, tea, credential helpers) need one
re-login.

SECRET_KEY is deliberately left on gitea-random: rotating it would break
the 2 push mirrors (encrypted creds) and must be done in a window that
re-enters those credentials.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-09-15 22:23:56 +03:00

application.yaml

Rotate gitea INTERNAL_TOKEN and JWT_SECRET into separate claims

2026-09-15 22:23:56 +03:00

kustomization.yaml

gitea to minimal kustomize

2026-01-05 06:26:23 +02:00

mariadb.yaml

gitea to minimal kustomize

2026-01-05 06:26:23 +02:00

README.md

gitea to minimal kustomize

2026-01-05 06:26:23 +02:00

README.md

Gitea

This application is managed by ArgoCD

Should ArgoCD be down manifests here can be applied with:

kustomize build . | kubectl apply -f -

Gitea DOES NOT go through Traefik. It has its own IP because ssh :22 would conflict with kube worker ssh. On its own IP, at the moment it doesn't flirt with Traefik — also has its own certificate.